Description:

There are two places in the shadow package where the strncpy function is mis-used. strncpy does not guarantee that the output string is NUL-terminated, yet subsequent code assumes that the output string does, in fact, end with a 0 byte.

This is not super-easy to exploit, but on a machine with a very long hostname *and* an attacker who can control the LOCALE and make a long localized string for "login: ", this will lead to a buffer overrun.

One possible fix is to replace the calls to strncpy with calls to strlcpy. In fact, strlcpy is precisely designed to avoid these kinds of bugs. You could accomplish this by applying the following patch in the shadow package.

This bug occurs upstream, but I was unable to get the upstream bugtracker to give me an account, so was unable to report it there. My hope is that it could at least be fixed in arch, or that if the arch package maintainers have upstream reporting privileges, they can relay the issue.

diff -ur shadow-4.1.4.3.orig/src/login.c shadow-4.1.4.3/src/login.c
--- shadow-4.1.4.3.orig/src/login.c 2011-03-09 23:50:02.234765395 -0800
+++ shadow-4.1.4.3/src/login.c 2011-03-09 23:50:24.033729799 -0800
@@ -748,7 +748,7 @@
sizeof (loginprompt),
_("%s login: "), hostn);
} else {
- strncpy (loginprompt, _("login: "),
+ strlcpy (loginprompt, _("login: "),
sizeof (loginprompt));
}

diff -ur shadow-4.1.4.3.orig/src/usermod.c shadow-4.1.4.3/src/usermod.c
--- shadow-4.1.4.3.orig/src/usermod.c 2011-03-09 23:50:02.234765395 -0800
+++ shadow-4.1.4.3/src/usermod.c 2011-03-09 23:50:33.614739810 -0800
@@ -182,7 +182,7 @@
struct tm *tp;

if ((negativ != NULL) && (date < 0)) {
- strncpy (buf, negativ, maxsize);
+ strlcpy (buf, negativ, maxsize);
} else {
time_t t = (time_t) date;
tp = gmtime (&t);